Proposal: add content source marking to TextContentBlock for cross-protocol trust decisions

[ZhengShenghan]

Problem

TextContentBlock currently has text, type, and optional annotations (audience, priority, last_modified). There is no field indicating where the content originated — whether it was generated by the agent itself, read from a local file, or received from an external tool (e.g., an MCP server).

This matters because ACP-Client agents commonly use external tools via MCP. Content from these tools may include attacker-controlled material (web pages, database rows, git commits). Without source marking, the editor receiving a session/update with text content cannot distinguish between:

• Text the agent composed itself
• Text read from a local file in the workspace
• Text received from an external MCP tool server (potentially untrusted)

Proposed Change

Add an optional source field to TextContentBlock:

TextContentBlock:
  type: "text"
  text: string
  annotations?: Annotations
  source?: "agent" | "tool" | "file" | "user" | "external"  # NEW

The field is optional and defaults to null for backwards compatibility. Agents that know the provenance of their content can set it; editors that understand it can use it for trust decisions (e.g., showing a visual indicator for externally sourced content, or requiring confirmation before applying externally sourced code edits).

Why This Complements the Permission Proposal

The permission proposal (#928) addresses whether an operation should proceed. Source marking addresses what kind of content is being operated on. Together they enable a policy like: "allow file writes from agent-generated content automatically, but require permission for externally sourced content."

Cross-Protocol Context

The MCP specification community is actively discussing similar content marking through specification enhancement proposals on output safety annotations. Adding source marking to ACP-Client would enable interoperability — an agent that receives MCP tool output with source metadata could propagate it to the editor via ACP-Client's source field.